Addendum to "Experimental demonstration of a quantum protocol for Byzantine 

agreement and liar detection" 
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Gao et al. [Phys. Rev. Lett. 101, 208901 (2008)] have described a possible intercept-resend 
attack for the quantum protocol for detectable Byzantine agreement in Phys. Rev. Lett. 100, 
070504 (2008). Here we describe an extension of the protocol which defeats such attacks. 
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Recently |l|, Gao et al. have pointed out that there 
exists an intercept-resend attack for the quantum proto- 
col for detectable Byzantine agreement described in Q. 
Here we describe how such attacks alter the entangle- 
ment of the distributed multipartite state and thus can 
be revealed by further analysis of the acquired data. 

The protocol uses the four-photon state 
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to distribute lists securely to three parties which then 
enable them to achieve the detectable Byzantine agree- 
ment . 

In 0], step (Hi) stated: "C randomly chooses a posi- 
tion from his list and asks A and B to inform him about 
their results on the same position. If all parties have 
measured in the same basis, their results must be suit- 
ably correlated." In the attack proposed in [l|, the traitor 
intercepts the qubits sent to one of the loyal generals and 
performs measurements on them. These measurements 
are single-qubit measurements in the {|0), |1)} basis of 
eigenstates of the Pauli matrix a z or in the {|0), |1)} ba- 
sis [where |0~) = (|0) + \l))/y/2 and |T) = (|0) - |l))/\/2] of 
eigenstates of the Pauli matrix <j x . Then, the traitor re- 
sends the qubits in the state resulting from the previous 
measurements to the loyal general. With this method, 
the traitor can obtain the other generals' secret lists 
which he can use to mislead the loyal generals into fol- 
lowing different plans. 

Since the roles of B and C in the protocol in are 
symmetrical, there are only three cases to be dealt with: 

(I) A (the commanding general) is the traitor and 
intercepts, measures, and resends the qubit sent to B 
(qubit c). 

(II) B is the traitor and intercepts, measures, and 
resends the two qubits sent to A (qubits a and b). 



(Ill) B is the traitor and intercepts, measures, and 
resends the qubit sent to C (qubit d). 

These attacks indeed do not alter the perfect corre- 
lations utilized in the protocol so far. However, they 
obviously change the entanglement of the four photon 
state and thus the correlations between the results if the 
parties measured along different directions. This can be 
used to detect the attack. There are several ways to foil 
these attacks. Here we present a simple method which 
does not require additional measurements and in which 
the traitor does not need to announce his actual results. 
In the following, we present an example of the method 
for each of the three cases. 

(I) Suppose that A is the traitor and intercepts and 
measures the qubit sent to B in the basis of eigenstates of 
<j z . In half of the cases, A obtains the result correspond- 
ing to |0) c and resends the state |0) c to B. Therefore, in 
these cases the state of the four qubits is 
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In the other half of the cases, A obtains the result corre- 
sponding to |l) c and resends B the state |l) c . Therefore, 
in these cases the state of the four qubits is 
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(2|0011)-|0110)-|1010))„6cd. (3) 



Therefore, after A's attack, the state of the four qubits 
is the mixed state 

Rated =\{\*')W + \*")(*"\) ab c<l. (4) 

Suppose that B and C measure their qubits in the ba- 
sis of eigenstates of a x . Then, C asks A and B for 
their results. When C checks them, C expects that 
— 37 which is the prediction for the state 
\^^')abcd- However, for the mixed state p a bcd, C finds 



/Pabcd 



= 0. 
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(II) If B is the traitor and intercepts and measures 
qubits a and b in the basis of eigenstates of <j z (resulting 
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TABLE I: Experimental data showing that an intercept- 
resend attack |l| has not occurred in the experiment described 
in [|. 







Experimental result 
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0.334 ± 0.025 
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in some mixed state p' abcd ) , and A measures qubits a and 



b in the basis of eigenstates of a x , then C expects that 
(a x a) ® a { x h) ) = | but finds (<r< a) ® ai h) ) p ^ d = 0. 

(77/) If B is the traitor and intercepts and measures 
qubit d in the basis of eigenstates of a z , and A and C 
measure their qubits in the basis of eigenstates of a x , then 
C expects that (a x a ' > ®<7x )*(4) = (oi ® cri rf) )^( 4 ) = -| 
but finds {ai a) <g> ai d) ) p » 6cd = (a x 6) a^)^ = 0. 

If C (or the other generals, since they exchange their 
roles in the next step) obtains results that do not satisfy 
the quantum predictions for the state \^^) a bcdi then the 
loyal generals decide to abort the protocol; otherwise, the 
loyal generals can reach an agreement using the lists. 

We show that in the experiment described in Q, ac- 
tual experimental data prove that the attack [l[ has not 
occurred. Table UJ contains all the tests described above 

(i) (i) 

and those obtained from them by changing a x by a\ 
for all qubits, exploiting the fact that the state |T]) is in- 
variant under the same unitary transformation applied 
to the four qubits. 

In conclusion, there is a simple method that makes the 
protocol in secure against the attack proposed in [l|. 
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